New Developments | Cyber Law Watch

Australia to be the most cyber secure nation?

Mar 05 2023

By Cameron Abbott, Rob Pulham and Dadar Ahmadi-Pirshahid

Not content with merely implementing broad-scale privacy reform, the Government has announced a new position, the Coordinator for Cyber Security to be added to the Department of Home Affairs as a step towards their aim of “making Australia the most cyber secure nation by 2030“. This would seem to be a rather aspirational target!

The Coordinator will be supported by a National Office for Cyber Security, and their role will be to oversee steps to prevent future cyber security incidents and to help manage cyber incidents as they occur.

Dec 14 2022

By Cameron Abbott, Rob Pulham and Stephanie Mayhew

As of yesterday, the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Privacy Enforcement Act) is now in effect after receiving Royal Assent on 12 December 2022.

As we have previously shared, the Privacy Enforcement Act increases the maximum penalties for serious or repeated privacy breaches. For body corporates/organisations this increases the penalty from the current $2.22 million to whichever is the greater of:

Nov 25 2022

By Cameron Abbott, Rob Pulham and Stephanie Mayhew

We’ve just returned from the annual iapp Australia/New Zealand privacy conference held in Sydney this week, and it was a whirlwind. Even if you’re not one of around half of Australians affected by two of the biggest data breaches in our recent history, you’ll be aware a lot is changing – and a lot more is poised to change – in this space.

We’ll be blogging over the coming weeks about some of the key themes and changes your organisation will need to prepare for, including:

– new regulatory enforcement tools

– higher expectations of the way personal information is collected and secured, and when it needs to be destroyed

– potential removal of key exemptions such as the employee records exemption that your business may currently rely on,

– and of course the major penalty increases that seek to deter privacy breaches being viewed as ‘the cost of doing business’,

as Australia tightens the protections around the collection and use of Australians’ personal information.

Stay tuned!

EU Digital Services Act: Fundamental Changes for Online Intermediaries?

Nov 21 2022

By Claude-Étienne Armingaud, Dr. Ulrike Elteste and Dr. Thomas Nietsch

The European Union has taken another step to set out its new legal framework for online intermediaries. Following the publication of the Digital Markets Act (Regulation (EU) 2022/1925) in the EU Official Journal on 12 October 2022, the Digital Services Act has now also been published in the EU Official Journal as Regulation (EU) 2022/2065.

While the Digital Markets Act focuses on the behavior of large “gatekeepers” towards other businesses, the Digital Services Act aims to fully harmonize the rules on the safety of online services and the dissemination of illegal content online. In particular, its Articles 4 to 10 replace the current provisions on the liability privilege enjoyed by online intermediaries in the eCommerce Directive 2000/31/EC. The privilege as such broadly remains intact, but is punctured in a number of ways. For example, the Digital Services Act encourages preemptive screening and provides that “trusted flaggers” must receive priority in the future. Providers of online platforms that allow consumers to enter into distance contracts with traders must obtain certain minimum information from the traders they admit to their platform. They may have to notify consumers if they become aware that products sold on their platform do not comply with legal requirements.

Again, “very large” online platforms and search engines receive the legislator’s (and the EU Commission’s) special attention. They must comply with additional transparency requirements and analyze and mitigate systemic risks.

But other intermediaries must also timely amend their terms of service, improve their complaint handling, and increase their transparency to avoid fines that can reach 6% of their global turnover. Specifically, online platforms must in the future provide clear information on “each specific advertisement presented to each individual recipient”, including “meaningful information directly and easily accessible from the advertisement about the main parameters used to determine the recipient to whom the advertisement is presented and, where applicable, about how to change those parameters”.

Most obligations bearing on companies subject to the Digital Services Act will start to apply on 17 February 2024. However, all but small online platforms and search engines will be required to publish information on the usage of their services (Statement) on their website, with an initial Statement to be published by 17 February 2023 at the latest. Intermediaries designated as “very large online platforms” or “very large online search engines” by the EU Commission will need to comply with most of their new obligations from four months after being notified of their “very large” status.

Argentina announces upgrades to data protection obligations

Sep 16 2022

By Cameron Abbott, Stephanie Mayhew and Dadar Ahmadi-Pirshahid

Argentina’s Data Protection Authority, the Agency for Access to Public Information (the Agency), has published a draft bill that proposes to bring Argentina’s 22 year old data protection law more in line with the European Union’s General Data Protection Regulation.

Amongst other things, the bill modernises Argentina’s data protection law to deal with more recent issues including cloud computing, biometric and genetic data. It provides greater scope for international transfers of information by allowing transfers under the sanction of adequate data protection guarantees in the absence of a decision by the Agency that the importing country has adequate data protection. It additionally requires Data Controllers to document and notify the Agency of data breaches within 48 hours of becoming aware of a breach.

The draft bill is open for public comment until 30 September 2022. Any entity wishing to submit commentary is encouraged to reach out to K&L Gates to help facilitate the submission process.

To pay or not to pay the ransom? Organisations may find their decision easier with government guidance

Jul 26 2021

By Cameron Abbott, Rob Pulham and Jacqueline Patishman

The Cyber Security Advisory Committee (an industry based advisory panel established by the Minister for Home Affairs to provide independent strategic advice on Australia’s cyber security challenges) has recommended in its annual report that the federal government develop a clearer policy position on the payment of ransoms by organisations that have suffered ransomware attacks.

Would mandatory reporting of ransomware payments cause more good or trouble?

Jul 15 2021

By Cameron Abbott, Warwick Andersen and Jacqueline Patishman

Last month, the federal opposition (Shadow Assistant Minister for Cyber Security) introduced the private member’s Ransomware Payments Bill (the Bill) that proposes to make it mandatory for all Australian businesses and government agencies to notify the Australian Cyber Security Centre (ACSC) before paying a ransom to a ransomware attacker. Failure to notify will attract a penalty of 1,000 penalty units ($181,740).

New Cyber Security Evaluation Tool released by US Homeland Security for organisations to self-test their security systems

Jul 14 2021

By Cameron Abbott, Warwick Andersen and Jacqueline Patishman

The United States Department of Homeland Security has developed the Cyber Security Evaluation Tool (CSET) which provides a systematic (and repeatable) process that critical infrastructure asset owners can use to assess and improve their cyber security management systems. This tool has a particular focus on the security of industrial control systems and information networks.

New US / Aus cross-border data access regime

Jul 12 2021

By Cameron Abbott, Warwick Andersen and Jacqueline Patishman

The Telecommunications Legislations Amendment (International Orders) Bill 2020 has just cleared both houses of parliament. The new bill establishes a reciprocal cross-border data access regime between the United States and Australia which will allow for cross-border communications between foreign governments for national security and law enforcement purposes.

Is ABC’s mandatory login into ABC iview legal?

Jun 27 2021

By Cameron Abbott, Warwick Andersen and Jacqueline Patishman

From July 1 all users of ABC’s on demand platform iview will be required to log in (and to have an account) to use the platform. It’s been reported that the former federal Privacy Commissioner, Malcolm Crompton, has been pushing to reverse the ABC’s decision, arguing that because the ABC is publically funded, Australians shouldn’t have to pay for content (which we have already paid for) with our data.

Category: New Developments

Australia to be the most cyber secure nation?

New Privacy Enforcement Act commences in Australia

Update from the Australia/New Zealand privacy conference and the changes to Australian privacy and cybersecurity laws

EU Digital Services Act: Fundamental Changes for Online Intermediaries?

To pay or not to pay the ransom? Organisations may find their decision easier with government guidance

Would mandatory reporting of ransomware payments cause more good or trouble?

New Cyber Security Evaluation Tool released by US Homeland Security for organisations to self-test their security systems

New US / Aus cross-border data access regime

Is ABC’s mandatory login into ABC iview legal?